Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/11/2024, 22:53

General

  • Target

    f795e1b377ca7b959281d03549eeb8baef0384ef674fe8dad0463c99563db34f.xls

  • Size

    70KB

  • MD5

    a8fd572dd740f3ad98d5ab51d37b5ef7

  • SHA1

    5cefe74dd54a77f31fdea23d1af28a5bd4bd0a7d

  • SHA256

    f795e1b377ca7b959281d03549eeb8baef0384ef674fe8dad0463c99563db34f

  • SHA512

    1f5c93abf53817eed8e6c6d543468ebcb0754ecee21f66a3e2d1ade85cff4304267915863e9bcc8c62b7b038fa42e7af8880e069e1b665da83eb037dd39d1a00

  • SSDEEP

    1536:5+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dgAYW/ESKQHS1yXJFadK0JB:kKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgr

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://farschid.de/verkaufsberater_service/OZRw36a2y1CH2clUzY/

xlm40.dropper

http://77homolog.com.br/dev-jealves/GP55wbYNXnp6/

xlm40.dropper

http://geowf.ge/templates/pJRea3Iu3wG/

xlm40.dropper

http://h63402x4.beget.tech/bin/wl0ENiE3BhELXV6V/

xlm40.dropper

http://ecoarch.com.tw/cgi-bin/E/

xlm40.dropper

https://galaxy-catering.com.vn/galxy/Fg1vvhlYJ/

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\f795e1b377ca7b959281d03549eeb8baef0384ef674fe8dad0463c99563db34f.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:552

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    52e45be91909e82b1cada1f88a09bf34

    SHA1

    7b1497d59fcf33b554ff15d32c566169aaf8ecbc

    SHA256

    4fe2025aaf5356e9383852d86e43488aa5e2dd22e9c723761ee773835fd578b4

    SHA512

    85664b738c68528bc8336103dc214866793790de0932f3db3716d3f8ff50930201ed11aedb931db8a196b83f94e237e07f90cce8155ab63f2beda5b9022e0d41

  • memory/552-11-0x00007FF800760000-0x00007FF800770000-memory.dmp

    Filesize

    64KB

  • memory/552-5-0x00007FF802A50000-0x00007FF802A60000-memory.dmp

    Filesize

    64KB

  • memory/552-4-0x00007FF802A50000-0x00007FF802A60000-memory.dmp

    Filesize

    64KB

  • memory/552-0-0x00007FF802A50000-0x00007FF802A60000-memory.dmp

    Filesize

    64KB

  • memory/552-3-0x00007FF842A6D000-0x00007FF842A6E000-memory.dmp

    Filesize

    4KB

  • memory/552-9-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/552-8-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/552-10-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/552-1-0x00007FF802A50000-0x00007FF802A60000-memory.dmp

    Filesize

    64KB

  • memory/552-7-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/552-15-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/552-12-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/552-6-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/552-16-0x00007FF800760000-0x00007FF800770000-memory.dmp

    Filesize

    64KB

  • memory/552-18-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/552-17-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/552-14-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/552-13-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/552-28-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/552-2-0x00007FF802A50000-0x00007FF802A60000-memory.dmp

    Filesize

    64KB